CVE-2020-28963: Buffer Copy without Checking Size of Input

Passcovery Co. Ltd ZIP Password Recovery v3.70.69.0 was discovered to contain a buffer overflow via the decompress function...

PT-2021-27863

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash occurs in the following functions: hufDecode, internal huf decompress, and internal exr un...

CVE-2021-43304

Heap buffer overflow in ClickHouse’s LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopyop, ip, copyend , don’t exceed the destination buffer’s limits. JFrog...

GHSA-3R3G-G73X-G593 coreos-installer improperly verifies GPG signature when decompressing gzipped artifact

Impact coreos-installer fails to correctly verify GPG signatures when decompressing gzip-compressed artifacts. This allows bypass of signature verification in cases where coreos-installer decompresses a downloaded OS image, allowing an attacker who can modify the OS image to compromise a...

coreos-installer improperly verifies GPG signature when decompressing gzipped artifact

Impact coreos-installer fails to correctly verify GPG signatures when decompressing gzip-compressed artifacts. This allows bypass of signature verification in cases where coreos-installer decompresses a downloaded OS image, allowing an attacker who can modify the OS image to compromise a...

PT-2021-27847

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read, which occurs in the internal huf decompress and internal exr undo piz functions, and is also associate...

grok:grk_decompress_fuzzer: Use-of-uninitialized-value in unsigned long grk::N_SSE4::vscheduler<grk::N_SSE4::DecompressDcShiftIrrev>

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=4578834326880256 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id...

OSV-2021-1417 Heap-buffer-overflow in openhtj2k::T1OpenHTJ2K::decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39632 Crash type: Heap-buffer-overflow WRITE 4 Crash state: openhtj2k::T1OpenHTJ2K::decompress std::1::packagedtaskfuncstd::1::bindgrk::T1DecompressScheduler::deco std::1::packagedtaskint...

PT-2021-27836

Name of the Vulnerable Software and Affected Versions openhtj2k affected versions not specified Description The issue is related to a heap-buffer-overflow error, specifically a WRITE 4 crash type. The crash occurs in the openhtj2k::T1OpenHTJ2K::decompress function. Technical details about the cra...

PT-2021-27834

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read, which occurs in the internal huf decompress function, specifically during the internal exr undo piz an...

bitcoin-core:txoutcompressor_deserialize: Use-of-uninitialized-value in CPubKey::Decompress

Project: https://github.com/bitcoin/bitcoin.git Detailed Report: https://oss-fuzz.com/testcase?key=6088511858540544 Project: bitcoin-core Fuzzing Engine: libFuzzer Fuzz Target: txoutcompressordeserialize Job Type: libfuzzermsanbitcoin-core Platform Id: linux Crash Type: Use-of-uninitialized-value...

OSV-2021-1344 Heap-buffer-overflow in openhtj2k::T1OpenHTJ2K::decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39021 Crash type: Heap-buffer-overflow WRITE 4 Crash state: openhtj2k::T1OpenHTJ2K::decompress std::1::packagedtaskfuncstd::1::bindgrk::T1DecompressScheduler::deco std::1::packagedtaskint...

PT-2021-27801

Name of the Vulnerable Software and Affected Versions openhtj2k affected versions not specified Description The issue is related to a heap-buffer-overflow error, specifically a WRITE 4 crash type. The crash occurs in the openhtj2k::T1OpenHTJ2K::decompress function, which is part of the...

grok:grk_decompress_fuzzer: Heap-buffer-overflow in openhtj2k::T1OpenHTJ2K::decompress

Detailed Report: https://oss-fuzz.com/testcase?key=6106031583789056 Project: grok Fuzzing Engine: honggfuzz Fuzz Target: grkdecompressfuzzer Job Type: honggfuzzasangrok Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x602000001054 Crash State:...

DEBIAN-CVE-2021-39262

A crafted NTFS image can cause an out-of-bounds access in ntfsdecompress in NTFS-3G 2021.8.22...

PT-2021-5802

Name of the Vulnerable Software and Affected Versions NTFS-3G versions prior to 2021.8.22 Description The issue is related to an out-of-bounds access in the ntfs decompress function of the NTFS-3G driver, which can be triggered by a crafted NTFS image. This can potentially allow an attacker to...

Excessive Iteration in Compress

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package...

GO-2021-0100 Denial of service via deadlock in github.com/containers/storage

Due to a goroutine deadlock, using github.com/containers/storage/pkg/archive.DecompressStream on a xz archive returns a reader which will hang indefinitely when Close is called. An attacker can use this to cause denial of service if they are able to cause the caller to attempt to decompress an...

c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in ZSTD_decompressBlock_internal

Detailed Report: https://oss-fuzz.com/testcase?key=5881749933522944 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasani386c-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0xf2713428 Crash State:...

The vulnerability of the `huft_build` function in the `archival/libarchive/decompress_gunzip.c` component of the BusyBox command-line utility suite, related to the manipulation of the null pointer, allows a malicious actor to trigger a denial-of-service attack.

The vulnerability of the huftbuild function in the archival/libarchive/decompressgunzip.c file of the UNIX utility command-line tool BusyBox is related to the use of a null pointer. Exploiting this vulnerability allows an attacker to cause a service failure by using a specially created ZIP file...